How to understand "registry" file in filebeat

Hello @luxiaoxun

I think the following would help.

Source: This is the path on disk for the file.
Offset: The last position read.
FileStateOS : This contains the information relative to inode and volume, we use that information to uniquely identify a file on disk, it help us track rename.
Timestamp: Record was last updated at.
TTL: Depenging on the user configuration, this will be used internally to know when to garbage collect the record and clean up some state.
count: number of updates for this specific record. (IIRC)